Deployment: Boot into RAM with Windows PE

Article
09/08/2016

New information has been added to this article since publication.
Refer to the Editor's Update below.

Deployment

Boot into RAM with Windows PE

Wes Miller

At a Glance:

Preparing a Windows PE ISO image
PXE-based RAMDisk booting
CD-based RAMDisk booting
Hard disk-based RAMDisk booting

Since its low-key introduction in August 2001, Microsoft Windows Preinstallation Environment has evolved into a much more powerful tool than Microsoft had originally intended. Last issue I

discussed the history of Windows® Preinstallation Environment, or Windows PE, and looked at how it has changed with subsequent versions. In this article, I'll explore a useful capability that has evolved over time: the ability to boot from a RAMDisk. (And the sidebar "Booting from a USB Flash Drive" looks at how boot options continue to become increasingly flexible.)

When first released, Windows PE could only boot from a CD, Windows Remote Installation Services (RIS) via Pre-Boot Execution Environment (PXE), and hard disk (using a cobbled-together method). With new versions came the ability to boot from an increasing number of devices.

When I was working on the Windows PE team at Microsoft and we were first developing the product, the Windows XP Embedded (XPE) team was busy building their own tools to make Windows XP work in new ways. Among their efforts was an initiative to define Windows XP through a series of components that could be custom-built using the embedded tools and then deployed to fixed-function Windows Embedded devices.

The XPE team outlined key scenarios that it wanted Windows XP Embedded to support. When Windows XP Service Pack 1 shipped, one of these scenarios was referred to as Remote Boot. Using a PXE bootstrap similar to RIS, Windows XP Embedded Remote Boot allowed an embedded device to boot over the network, using a RAMDisk as its boot drive. Let's take a closer look at this so you can see how it relates to Windows PE:

The PXE client boots and a PXE boot is requested. (Depending on how your PC is configured, this may involve a BIOS boot selection at boot time or possibly pressing F12 once or twice.)
The PXE client sends out a special UDP broadcast message—a modified Dynamic Host Configuration Protocol (DHCP) discover request.
The DHCP server (which may or may not be the actual PXE server) sends back an offer, which includes valid network information and the address of the PXE server.
The PXE client responds with a request for a Network Boot Program (NBP). This is a small executable image that can perform a defined task.
The PXE server responds with an acknowledge response that includes the Trivial File Transfer Protocol (TFTP) download location of the NBP, which the client then begins to download.
The NBP is executed. In the case of Windows (RIS, ADS, or Remote Boot), execution involves running a small 16-bit app called startrom.com (or startrom.n12, which is a version that doesn't require the user to press the F12 key). [**Editor's Update - 10/18/2006:**In RIS, this file is called startnbs, not startrom.com] Startrom then goes back to the TFTP server and downloads the Windows NT Boot Loader (NTLDR) or a file named accordingly (setupldr.exe renamed as NTLDR in the case of Windows PE RAMDisk boot).
In the case of Remote Boot, the NTLDR pulls down a boot.ini file (winnt.sif in the case of Windows PE RAMDisk boot), which specifies where to find the RAMDisk file to load.
The NTLDR pulls this RAMDisk file down directly into RAM, and initializes just as it would if it were booting directly from a hard disk.

With Windows XP Embedded, this technique allowed for a group of devices (kiosks, point-of-sale terminals, and so on) to boot from one central PXE server without requiring dedicated hard disks on the devices. The RAMDisk image is placed completely in local RAM by the NTLDR. With this approach, a device must have enough local RAM to hold the "boot disk" while still leaving enough RAM free for the working set. This also means that if the device is reset, the boot image must be downloaded again.

Working PXE into Windows PE

From the time we first shipped Windows PE, customers liked the ability to PXE boot, but often didn't like that we required Remote Installation Services (RIS) to do so. Since RIS requires Active Directory®, and no manufacturer was likely to have Active Directory implemented on a fast-moving factory floor, OEMs had even more reason to complain. As we started planning for Interim Windows PE (iWinPE), we knew we had to support the ability to PXE boot Windows PE from any PXE server, not just RIS.

Our team (working on Windows PE) was integrated with the XPE team, and using the existing Remote Boot functionality as a bootstrap (forgive the pun) seemed the most logical place to start. We investigated what would have to change in order to allow Windows PE to remote boot and we found that the answer was "not much."

We did decide on one key change. The Windows XP Embedded implementation of Remote Boot worked by booting an SDI file. SDI files are sector-based disk images, not unlike those used by many deployment technologies. Since Windows PE discards all registry writes while running—effectively working read-only so it can run from a CD—the ISO file format (a virtual CD, if you will) was a more natural choice. We incorporated this change and shipped this with Windows Server® 2003 SP1. Note that this functionality is only available for use with x86 and x64 architectures of Windows. It does not work with the Intel Itanium (IA64) architecture.

The RAMDisk boot functionality allows the NTLDR to load any compatible ISO image of Windows PE into RAM and boot it. While our initial focus was PXE booting, the RAMDisk boot capabilities are also useful for several other scenarios that I'll discuss. This article will go over three key scenarios—PXE RAMDisk boot, Hard disk RAMDisk boot, and CD RAMDisk boot—and walk you through the steps to perform each.

Regardless of the method you use, RAMDisk booting uses up a significant (though not unreasonable) amount of RAM. For a default Windows PE image you'll need at least 145MB of RAM for the RAMDisk and at least 96MB for the working set. To use one of these RAMDisk methods, you also must build your Windows PE image from Windows Server 2003 SP1 media—either Standard Edition or Enterprise Edition. A Windows PE image created from the original release of Windows Server 2003 or any release of Windows XP will not work.

Windows PE Q&A

Q Why does Windows PE always use X: as its boot letter?

A Beginning with Windows PE 2004, the boot drive is assigned the drive letter "X". It changed both for consistency (so you always know which drive is your Windows PE drive) and because certain components added to Windows PE with Service Pack 1 required a consistent boot drive letter to work.

Q I added a driver to Windows PE—why isn't it working?

A This is usually due to a missing dependency. Check the .inf file for the driver and ensure you haven't missed any required files listed in the .inf. This may include files with extensions you aren't used to, not just *.sys files. The driver looks for them and silently fails to initialize if these dependencies aren't found.

Preparing a RAMDisk Boot Image

To create a RAMDisk boot image, you always begin by creating the actual ISO image that will be booted into RAM. This is the virtual CD that will be stored in RAM while Windows PE is running, regardless of what medium you boot it from. You should keep the ISO image's size to a minimum. This involves removing any unnecessary files (Windows PE documentation includes a list of removable files) and including only the files that are necessary for your image to work. For example, you should include any network interface card (NIC) and mass-storage controller (MSC) drivers, and any binaries or dependencies necessary for your application. Remember that only the files included in the ISO will be available in the RAMDisk image. In most scenarios, you will have two drives available: the drive or device that you booted from (unless you use PXE, which won't map the drive) and the RAMDisk-booted CD image, which will always appear as your X: drive. The X: drive will act as a CD-ROM drive, even if your system does not have a local CD or DVD drive.

The steps for preparing a RAMDisk boot image are nearly identical to those involved in creating a normal Windows PE image, with one exception: you do not need to specify a boot sector when creating the RAMDisk ISO image. Say you are creating a standard Windows PE image in a directory called C:\Staging\. You would create the Windows PE image using mkimg.cmd and then create the ISO image using OSCDIMG as follows:

OSCDIMG -n –betfsboot.com C:\Staging\ C:\Staging.ISO

To prepare a RAMDisk boot image, you could omit the command-line option "-betfsboot.com". And now the image itself is ready to be included in one of the following scenarios.

PXE RAMDisk Boot

The PXE RAMDisk boot scenario allows you to boot a system from any PXE server. PXE is invaluable for providing a centralized boot from a single server (for imaging a training lab or classroom, for example) or for rapidly booting systems without a CD-ROM drive (or without requiring a CD to be inserted). This can dramatically improve how quickly OEMs or businesses can install Windows onto new PCs.

Here's a general overview of the steps needed to perform a PXE RAMDisk boot, though some of the steps may differ slightly depending on your particular PXE server (consult your documentation for details):

Insert your integrated Windows Server 2003 SP1 CD. (Alternatively, you can browse to a Universal Naming Convention, or UNC, share of Windows Server 2003 SP1.)
Copy ntdetect.com and setupldr.exe from the I386 directory (do not select setupldr.bin).
Paste these two files into the root of the PXE server. Rename the setupldr.exe file as ntldr (note that it has no file extension).
Copy the ISO image you created earlier to the root of your PXE server.
Create a new text file in the root of the PXE server and name it winnt.sif.
Open winnt.sif in Notepad and enter the following text (but be sure to use the name you gave your ISO file):
```
[SetupData]
BootDevice = "ramdisk(0)"
BootPath = "\I386\System32\"
OsLoadOptions = "/fastdetect /minint /rdexportascd /rdpath=Staging.iso"
Architecture = "I386" 
```
Note that case sensitivity may matter if you are using a non-Windows PXE server.
Ensure that your clients are set to boot from the specified PXE server. This is typically done by specifying the client's MAC address or its SMBIOS GUID to the PXE server. (For information on retrieving the MAC and GUID, see support.microsoft.com/kb/302467.)

CD RAMDisk Boot

The CD RAMDisk boot is useful for what is referred to as CD swapping. In this scenario, the boot CD you use to initialize Windows PE can be removed once Windows PE has been loaded into an ISO RAMDisk. This CD swapping functionality was particularly critical to certain OEM and IHV recovery solutions, which traditionally work by reimaging an entire PC from disk images that are stored on more than one disk or from a hidden partition. Let's walk through the steps used to create the RAMDisk-booted CD:

Insert your integrated Windows Server 2003 SP1 CD. (Or you can browse to a UNC share of Windows Server 2003 SP1.)
Copy ntdetect.com and setupldr.bin from the I386 directory. (Note that this is different from the previous scenario where you copied setupldr.exe.)
In the staging location where you are building your Windows PE image, create a new text file and name it winnt.sif. Create a directory named I386.
Copy the ISO file, ntdetect.com, and setupldr.bin into the root of this new directory without renaming the files.

Open winnt.sif in Notepad and enter the following text (use the name of your ISO file):

[SetupData]
BootDevice = "ramdisk(0)"
BootPath = "\I386\System32\"
OsLoadOptions = "/fastdetect /minint /rdexportascd /rdpath=I386\Staging.iso"
Architecture = "I386"

Now copy any content you need to the staging directory itself.
Once you are ready to create your final CD image, run the following:
```
OSCDIMG -n –betfsboot.com C:\Staging\ C:\Staging.ISO
```

Your image is now ready to be burned to CD. Anything you add to the CD outside of the RAMDisk image will be available when the disk is in the drive, but it will not be loaded into RAM. The RAMDisk will be drive letter X. The CD-ROM drive will be the first drive letter after the last partition enumerated on the system (often D). This is important if you are writing scripts that are looking for files on discs other than the RAMDisk.

Hard Drive RAMDisk Boot (Single Partition)

Though this method is not commonly used, hard drive RAMDisk booting is a useful option for certain scenarios. As the name implies, this approach boots from a hard disk into RAM. Once loaded, Windows PE no longer has any dependencies on the disk it just booted from. Thus, once Windows PE has been loaded, the partitions can be completely wiped clean. This can be done with a single partition (the easier, though potentially more dangerous, method) or you can use multiple partitions. Let's look at the steps involved in both approaches.

For a single partition, you must:

Insert your integrated Windows Server 2003 SP1 CD. (Or browse to a UNC share of Windows Server 2003 SP1.)
Copy ntdetect.com and setupldr.bin from the I386 directory.

Create a new text file named winnt.sif and enter the following text into it (using the name you gave your ISO file):

[SetupData]
BootDevice = "ramdisk(0)"
BootPath = "\I386\System32\"
OsLoadOptions = "/fastdetect /minint /rdexportascd /rdpath=Staging.iso"
Architecture = "I386"

Use either scripting on the remote machine or the Windows administrative share (\\machinename\c$) to place all of the following on the remote machine's System drive (generally C:): ntdetect.com (save the old one); rename the setupldr.bin file as NTLDR and replace the existing NTLDR with it (again, save the old one); a copy of winnt.sif; and a copy of the RAMDisk ISO file you created earlier. The end result should be two new and two replaced files on the remote machine's System drive.

Booting from a USB Flash Drive

Windows PE 2005 introduced support for booting from USB flash drives. It's a handy option but, unfortunately, it requires a partitioning tool that is only available to Windows OEMs. There is a reason for this, however. In order to safely boot a PC from a USB flash drive, there are some essential requirements:

The BIOS must support boot from USB Mass Storage.
The BIOS must support USB. (Ideally it should also have built-in support for Hi-Speed USB 2.0, as this dramatically improves Windows PE boot performance.)
The PC must support power to the USB bus at boot time.
Ideally, the PC should also support Hi-Speed USB 2.0.

Some of these system capabilities can be easily tested. However, not all of them can—so there is no safe way for users to create a USB Flash Drive with Windows PE on it and ensure it will just work on all Windows systems. So the safest solution—until Windows Vista ships, that is—was to provide the necessary tools to OEMs. They can, in turn, develop and test USB flash drives, indicating which ones work with which systems. Windows Vista will offer a better solution. Several logo requirements were specifically designed to ensure that any PC carrying a Windows Vista logo supports USB Flash Drive boot.

At this point, any reboot will cause the system to boot into a Windows PE RAMDisk. This means you can script a reboot and the system can complete any necessary tasks, independent of the hard disk. The machine is actually stuck in a loop where only Windows PE will boot. If you want to reboot into Windows, you must put the original NTLDR and ntdetect.com files back in place.

Hard Drive RAMDisk Boot (Multiple Partitions)

For a setup with multiple partitions, the process is very similar to the one used in a single partition setup. The main difference is that you must prepare an additional partition for Windows PE. This requires enough space to store the Windows PE image and any other working files. Let's take a look at how this process differs from the process I described for a single partition setup.

You must create a partition if it doesn't already exist.
Copy ntdetect.com, setupldr.bin, winnt.sif, and the RAMDisk ISO file (see Step 4 of the single partition process described earlier) to the new partition.
When you're ready to boot to this partition, mark it active, using DiskPart. You should also mark the existing partition as inactive. (For information on using DiskPart, see microsoft.com/resources/documentation/windows/xp/all/proddocs/en-us/diskpart.mspx.)

On the next reboot, your system will boot into Windows PE. Note that you're rebooting from the second partition, but into RAM. Therefore, you could theoretically wipe out the second partition, just as you can do when working with a single partition setup.

To resume booting into Windows, set the new partition as inactive and set the Windows partition as active. Remember to use both inactive and active. A PC will boot from the first active partition it finds with a Master Boot Record (MBR), even if all four potential primary MBR partitions are active.

Summary

Windows PE has evolved into a very flexible deployment and recovery tool. This article has explained how various methods for performing RAMDisk boots with Windows PE, and I've identified some specific scenarios where each method can be useful. In my next article, I'll discuss some of the new features and capabilities of Windows PE 2.0—the exciting new version that will ship with Windows Vista.

Wes Miller is the Product Technology Strategist at Winternals Software in Austin, Texas, where he focuses on all Winternals products, including Protection Manager, the Winternals Enterprise Security product. Previously, Wes worked at Microsoft as a Program Manager and Product Manager for Windows enterprise deployment.

Additional resources